Bithumb reports breach of internal staff groupware

Bithumb said it detected unauthorized access to its internal mobile groupware on Tuesday, 27 October, and disclosed the breach the next day. The exchange said the compromised system is used by employees for communication and administrative work, and that initial findings pointed to employee records. It is investigating whether customer data was also exposed.

The distinction matters because the groupware is not used by customers and is physically separated from Bithumb's trading network, the company said. Customer crypto assets were unaffected, it said. Bithumb has not disclosed how many people are affected, what categories of data were taken, or who was behind the access.

What Bithumb disclosed

An external party accessed the third-party mobile groupware platform, Daou Office, which Bithumb operates for staff communication and daily tasks, according to The Korea Herald. Bithumb reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission. It said it would provide further details as its investigation progressed.

The exchange has not named the attackers or described how they got in. It also has not said whether account services such as deposits or withdrawals were disrupted. Bithumb said the breached environment could not be used to reach customer virtual assets because it is separate from the trading platform.

A wider wave

The disclosure came during a weeks-long wave of cyberattacks across South Korean finance. Daishin Securities said on the same day that personal and credit information belonging to 38,490 customers had been compromised after an intrusion into a server supporting online account openings. The brokerage detected suspicious access on 17 October and reviewed more than 60,000 requests disguised as legitimate traffic over 10 days, The Korea Herald reported.

Mirae Asset Global Investments also confirmed unauthorized access to some web systems and said it blocked the routes. Its life insurance affiliate reported a breach earlier in the week and drew an on-site inspection from the Financial Supervisory Service. The FSS has dispatched inspectors to Daishin and is assessing the Bithumb and Mirae incidents, according to The Korea Herald.

The Financial Services Commission and the FSS reported on 14 October that breaches at 16 companies and institutions involved about 100,000 records containing customer information, The Korea Times reported. Against Daishin's 38,490 affected customers, Bithumb's silence on its own count leaves the scope of any customer exposure unclear.

Regulator pressure

FSS Gov. Lee Chan-jin met board chairs from eight banking groups on 28 October and said attacks were moving beyond core systems. "Cyberattacks are becoming increasingly sophisticated, with targets expanding to noncore systems," Lee said, according to The Korea Herald. He warned that AI could make it easier for attackers to identify vulnerabilities and launch simultaneous attacks.

The Financial Security Institute cautioned against linking the campaign to any state. An official said IP addresses alone cannot establish an attacker's nationality or affiliation because address information can be manipulated and traffic routed through other locations, The Korea Times reported.

Second internal-control test

The breach is not Bithumb's first operational problem this year. In February, the exchange credited users with 620,000 BTC instead of 620,000 won, an error worth more than $40 billion at the time. CEO Lee Jae-won acknowledged weaknesses in the company's internal controls after that incident, according to Crypto Economy.

The new breach entered through an employee communication tool, not the trading engine. It will be read against that record as Bithumb investigates whether member data sat on the same system.

What happens next

The scope of any customer data exposure remains unresolved. Bithumb said it would issue further public statements as findings come in. Until then, users cannot tell whether their records were on the compromised system.